NIST IR 8547: The Post-Quantum Cryptography Transition Roadmap

NIST has published its roadmap for the post-quantum transition. The real work starts now.

On October 27, 2026, the National Institute of Standards and Technology (NIST) published the final version of NIST IR 8547: Transition to Post-Quantum Cryptography Standards.

The report marks an important step in the transition towards quantum-resistant cryptography. While NIST standardised its first post-quantum algorithms in 2024, organisations still needed a clearer picture of what would happen to the cryptographic standards they rely on today—and how the transition should be organised.

NIST IR 8547 addresses that challenge. It identifies existing quantum-vulnerable cryptographic standards, the post-quantum standards intended to replace them, and the milestones guiding the transition.

For organisations, the message is becoming increasingly concrete: the post-quantum transition is no longer simply about preparing for a future technology. It is about planning the gradual replacement of cryptographic mechanisms already embedded across today's IT environments.

And that is a much larger undertaking than changing an algorithm.

What is NIST IR 8547?

NIST IR 8547 is NIST's final report outlining its approach to transitioning from quantum-vulnerable cryptographic algorithms to post-quantum cryptography (PQC).

Its purpose is to provide a reference for federal agencies, technology providers, standards organisations and other stakeholders as they prepare their migration roadmaps.

The report builds on the post-quantum standards published by NIST in August 2024:

• FIPS 203 – ML-KEM: a post-quantum key-encapsulation mechanism, designed to establish shared secret keys.

• FIPS 204 – ML-DSA: a post-quantum digital signature standard.

• FIPS 205 – SLH-DSA: a stateless hash-based digital signature standard.

These standards provide the cryptographic building blocks for the transition. IR 8547 adds an important piece: a roadmap for moving away from the algorithms that will no longer be suitable in a post-quantum environment.

In other words, the question is no longer only which algorithms organisations should adopt. It is also which existing mechanisms need to be phased out, in what order, and how to manage the transition without compromising operational continuity.

Which cryptographic standards are affected?

The concern centres on public-key cryptography.

Many of the algorithms currently used to establish secure connections, exchange keys and authenticate digital identities rely on mathematical problems that sufficiently powerful quantum computers could solve much more efficiently than classical computers.

Shor's algorithm, for example, poses a theoretical threat to widely deployed public-key mechanisms such as RSA and elliptic-curve cryptography.

This does not mean that these algorithms are already broken. A cryptanalytically relevant quantum computer capable of carrying out such attacks does not currently exist. However, the long-term confidentiality of information and the continued reliability of digital signatures make waiting for that moment a poor migration strategy.

NIST IR 8547 identifies the quantum-vulnerable standards that will need to transition and maps them to post-quantum alternatives.

The implications extend across several areas:

• Key establishment: mechanisms used to establish shared secrets and protect communications.

• Digital signatures: algorithms used to authenticate users, devices, software and digital transactions.

• Public-key infrastructure: the certificate authorities, keys, certificates and trust relationships that support digital identity and authentication.

For organisations, this means looking beyond individual encryption products. The transition will affect systems, applications, protocols and trust infrastructures that depend on public-key cryptography.

What are the key post-quantum migration deadlines?

NIST IR 8547 supports the US federal government's migration roadmap, including the milestones established by Executive Order 14412 and OMB Memorandum M-26-15.

The federal timeline brings two priority milestones into focus:

These dates require some context.

The 2030 and 2031 milestones apply to specified US federal systems and priorities. They are not universal legal deadlines for every private organisation. However, companies working with federal agencies, supplying technology to government environments or operating within affected supply chains may need to account for these requirements.

Beyond the federal deadlines, the report provides a broader signal to the technology ecosystem: the transition away from quantum-vulnerable cryptography needs to be planned well in advance.

Organisations should therefore assess their own exposure, contractual obligations, regulatory environment and the expected lifetime of the data and systems they protect.

Why the transition cannot wait until 2030

One of the main reasons for starting early is the harvest now, decrypt later threat.

An attacker does not need a quantum computer today to collect encrypted information. They can intercept and retain sensitive data now, with the intention of decrypting it when sufficiently powerful quantum technology becomes available.

This creates a particular risk for information that must remain confidential over long periods: intellectual property, financial records, government information, healthcare data and sensitive communications.

The relevant question is therefore not simply when a quantum computer will become capable of breaking current cryptography.

It is also: how long must the information we protect remain secure?

If data intercepted today needs to remain confidential for another 10, 15 or 20 years, the migration window may be much shorter than it first appears.

This is why NIST highlights the possibility of prioritising post-quantum key establishment for particularly sensitive information. Not every system needs to migrate at the same time, but organisations need a risk-based approach to decide where to begin.

The practical challenge: knowing what needs to change

The publication of a migration roadmap does not make the transition straightforward.

For most organisations, cryptography is distributed across a complex environment. It is embedded in applications, network infrastructure, cloud services, identity systems, connected devices, certificates, protocols and third-party products.

A company may know that it uses RSA or elliptic-curve cryptography in certain systems without having a complete picture of where these algorithms are deployed, which assets depend on them, or who is responsible for changing them.

This lack of visibility creates a fundamental obstacle.

Before deciding what to replace, organisations need to understand what they currently have.

A practical post-quantum migration programme should address five areas:

1. Discover cryptographic assets

Build an inventory of cryptographic assets across the IT environment. This includes certificates, public and private keys, algorithms, protocols, cryptographic libraries and the systems that depend on them.

The objective is to move beyond isolated inventories and establish a more complete view of the cryptographic estate.

2. Identify quantum-vulnerable dependencies

Determine where vulnerable public-key algorithms are used and understand which applications, services and business processes depend on them.

A certificate inventory alone will not necessarily reveal every cryptographic dependency. The assessment needs to extend to the underlying systems and technologies that use cryptography.

3. Prioritise migration based on risk

Not every asset presents the same level of exposure.

Organisations should consider data sensitivity, confidentiality lifetime, system criticality, external dependencies and the feasibility of replacing existing cryptographic mechanisms.

Systems protecting information that must remain confidential for many years may require earlier attention.

4. Assess post-quantum compatibility

Evaluate whether existing applications, infrastructure, hardware and third-party services support the new standards.

This includes testing interoperability, performance, key sizes, signature sizes and protocol compatibility. NIST also discusses hybrid approaches that combine conventional and post-quantum cryptography during the transition.

A hybrid approach can help manage the transition, but it also introduces implementation and performance considerations that need to be assessed.

5. Build cryptographic agility into the architecture

The transition to PQC will not be the last time organisations need to adapt their cryptographic choices.

Cryptographic agility is the ability to replace or update cryptographic algorithms, keys, certificates and protocols without having to redesign entire systems.

It is therefore not just a post-quantum requirement. It is a long-term resilience capability.

Why PKI will be central to the post-quantum transition

Public Key Infrastructure sits at the heart of digital trust.

It enables organisations to issue, distribute, manage and validate digital certificates used to authenticate users, devices, applications and services.

As post-quantum standards evolve, PKI environments will need to accommodate new algorithms, key types, certificate profiles and trust requirements. Organisations will also need to manage the coexistence of traditional and post-quantum cryptography during migration.

This creates several operational challenges:

• Maintaining visibility over certificates and their cryptographic characteristics.

• Understanding which applications and services depend on existing certificates.

• Managing certificate issuance and renewal as cryptographic requirements evolve.

• Coordinating changes across certificate authorities, endpoints, applications and infrastructure.

• Preserving availability and trust throughout the migration.

A fragmented or poorly documented PKI environment makes these changes harder to coordinate.

Certificate Lifecycle Management (CLM) can help organisations establish control over certificate discovery, issuance, renewal, monitoring and governance. It provides an operational foundation for managing certificate estates as cryptographic requirements change.

However, post-quantum readiness extends beyond certificates. Organisations also need visibility into the wider cryptographic assets and dependencies across their infrastructure.

That is where Cryptographic Posture Management becomes relevant: helping organisations discover cryptographic assets, understand their exposure and build a more informed remediation roadmap.

From NIST's roadmap to your organisation's roadmap

NIST IR 8547 gives organisations a clearer direction for the post-quantum transition. But the report should not be treated as a migration checklist that can simply be applied to every IT environment.

Each organisation will need to translate the standards and timelines into a plan based on its own infrastructure, risk exposure, business priorities and technology dependencies.

The first step is not necessarily to deploy a new algorithm. It is to establish a reliable understanding of the cryptography already in use.

Without that visibility, it is difficult to assess exposure, prioritise investments or coordinate a migration across systems that were never designed to change cryptographic mechanisms at this scale.

The post-quantum transition is ultimately an exercise in managing change across the foundations of digital trust.

The organisations that start building visibility and cryptographic agility now will be better positioned to make that transition without losing control of the systems and services that depend on cryptography.

Frequently asked questions

What is NIST IR 8547?

NIST IR 8547 is the final NIST report published on October 27, 2026, outlining the transition from quantum-vulnerable cryptographic algorithms to post-quantum standards. It identifies affected cryptographic standards, their intended replacements and migration considerations.

When should organisations migrate to post-quantum cryptography?

There is no single universal deadline for all organisations. US federal milestones include 2030 for post-quantum key establishment in specified high-priority systems and 2031 for digital signatures. Organisations should define their own migration timelines based on risk, data sensitivity, system dependencies and applicable requirements.

Which algorithms are threatened by quantum computing?

Shor's algorithm threatens widely used public-key cryptographic mechanisms, including RSA and elliptic-curve cryptography. NIST IR 8547 identifies quantum-vulnerable standards and the post-quantum standards intended to replace them.

What are the NIST post-quantum cryptography standards?

The first three finalised NIST PQC standards are FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for digital signatures and FIPS 205 (SLH-DSA) for digital signatures.

Why is PKI important for post-quantum migration?

PKI supports digital identity, authentication and secure communications through certificates and public-key cryptography. Its architecture, certificate profiles and operational processes will need to evolve to support post-quantum algorithms and hybrid deployments.

What is cryptographic agility?

Cryptographic agility is the ability to change cryptographic algorithms, keys, certificates and protocols without extensive redesign of the systems that depend on them. It is a key capability for managing the post-quantum transition and future cryptographic changes.

Explore more on post-quantum cryptography

• Why PQC Migration Starts Long Before Algorithm Replacement

• The G7 Call to Action on Post-Quantum Migration: Why This One Puts PKI at the Center

• CBOM: What a Cryptographic Bill of Materials Is, and Why You Will Be Asked for One